ESET Details Evolution of UAC-0099’s MATCHBOIL Malware
Summary
ESET analyzes MATCHBOIL samples from 2024 to 2026, detailing how the UAC-0099 downloader evolved its obfuscation, persistence, sandbox checks, and delivery behavior. The group used it in campaigns targeting organizations in Ukraine.
Key points
- MATCHBOIL is a C# downloader used by Russia-aligned UAC-0099 to retrieve, install, and persist additional payloads, often the MATCHWOK backdoor.
- The malware is delivered through spear-phishing links that download an archive containing a VBScript; victims must execute the script for the infection to proceed.
- From 2024 to 2026, MATCHBOIL shifted from custom string encryption and Unicode obfuscation to Eziriz .NET Reactor, and its persistence methods changed between registry Run keys and scheduled tasks.
- Late-2025 variants added sandbox and debugger checks, deceptive graphical interfaces, and repeated command-and-control requests on a two-minute timer.
- The April 2026 variant is a DLL launched by a custom C# loader and checks the operating system’s installation date as part of its virtual-environment screening.
- ESET observed samples at organizations in Ukraine across transportation, manufacturing, and energy sectors.
Article Details
- Attack Vectors
- UAC-0099 distributes MATCHBOIL through malicious links in spearphishing emails. The link downloads an archive containing a VBScript that downloads and executes MATCHBOIL after the victim runs the script manually.
- MATCHBOIL retrieves and installs a payload from its C&C server; in most analyzed cases, the payload is the MATCHWOK backdoor.
- Defensive Notes
- Monitor for MATCHBOIL behavior including repeated HTTPS requests to its C&C, retrieval of hex-encoded payloads, and installation of files under %LOCALAPPDATA%.
- Inspect persistence mechanisms described in the article: Windows Run registry entries and scheduled tasks.
- The malware checks Windows event-log uptime and debugger attachment, and newer variants check the operating system installation date to identify analysis environments.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | airarticlegenerate[.]com | MATCHBOIL C&C domain. |
| DOMAIN | flycloud-service[.]com | MATCHBOIL C&C domain. |
| DOMAIN | telemetry-conf[.]com | MATCHBOIL C&C domain hidden behind Cloudflare. |
| DOMAIN | virtualdailyplanner[.]pro | MATCHBOIL C&C domain hidden behind Cloudflare. |
| IPV4 | 64[.]95[.]10[.]223 | MATCHBOIL C&C IP address hosted on a VPS. |
| IPV4 | 64[.]95[.]13[.]210 | MATCHBOIL C&C IP address hosted on a VPS. |
| SHA1 | 026f892630d0a4fe854a75984695ba99af0022c4 | SHA-1 hash of a MATCHBOIL downloader. |
| SHA1 | 050926727cdd74f0b3a8a098e60b76d10fb06b14 | SHA-1 hash of a MATCHBOIL DLL sample. |
| SHA1 | 1e2c4aac30edff86cd9a30bd08b199bcd3d0ccce | SHA-1 hash of a MATCHBOIL sample. |
| SHA1 | 6d72b56b86fd5ed9bd188c8c88cfc69476f836e7 | SHA-1 hash of a MATCHBOIL downloader DLL. |
| SHA1 | a926889bab31f3c34663d18c05c4e862ef367028 | SHA-1 hash of a MATCHBOIL downloader. |
| SHA1 | b6569b0050b864c4a0d32326954bc2d3852a3958 | SHA-1 hash of a MATCHBOIL DLL containing C&C and payload-persistence logic. |
| SHA1 | c85d28f7d272ce2bbbfb9dae71d21bf25b8d00fc | SHA-1 hash of a MATCHBOIL downloader sample. |
| SHA1 | f886b615cb9e23ead2718ff2a61155acfb04ce9e | SHA-1 hash of a MATCHBOIL downloader sample. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe article’s ATT&CK table reports that MATCHBOIL used the filename Thumbs.db for a downloaded payload.T1047 · Windows Management InstrumentationMATCHBOIL uses WMI queries to collect system information from victim machines.T1053.005 · Scheduled TaskMATCHBOIL and its payload use scheduled tasks for persistence.T1071.001 · Web ProtocolsMATCHBOIL uses HTTPS for C&C communication.T1106 · Native APIThe article’s ATT&CK table states that MATCHBOIL uses Windows APIs for C&C communication.T1132.001 · Standard EncodingMATCHBOIL receives its payload hex-encoded during C&C communication.T1140 · Deobfuscate/Decode Files or InformationMATCHBOIL decrypts strings at runtime, including strings used for C&C communication and payload-installation directories.T1497.001 · System ChecksMATCHBOIL queries Windows event logs and checks system uptime to detect sandboxed or analysis environments.T1547.001 · Registry Run Keys / Startup FolderMATCHBOIL has persisted its payload through a Windows registry Run entry.T1573.002 · Asymmetric CryptographyMATCHBOIL uses TLS to encrypt C&C communication.T1583.001 · DomainsUAC-0099 registered domains used for MATCHBOIL C&C communication.T1583.003 · Virtual Private ServerUAC-0099 used virtual private servers to host MATCHBOIL C&C servers.T1587.001 · MalwareUAC-0099 developed MATCHBOIL.T1587.003 · Digital CertificatesUAC-0099 used Let’s Encrypt TLS certificates for MATCHBOIL C&C servers.T1588.002 · ToolUAC-0099 used Eziriz .NET Reactor to obfuscate MATCHBOIL.T1622 · Debugger EvasionSome MATCHBOIL variants check whether they are attached to a debugger.T1678 · Delay ExecutionThe article’s ATT&CK table reports that MATCHBOIL abuses the Sleep API to delay execution.
Threat Actors
Malware
LONEPAGEApart from MATCHBOIL, the group also typically deploys LONEPAGE, a PowerShell downloader named after the presence of the word page in its C&C URLs.MatchBoilESET researchers have documented the evolution of the MATCHBOIL malware, a custom C# downloader wielded by the Russia-aligned UAC-0099 APT group.MatchWokFrom our analysis, we have discovered that in most cases, the hex-encoded payload to be installed on the victim machine is a C# backdoor known as MATCHWOK, used exclusively by UAC-0099 and firstly documented by CERT‑UA.
Products
Eziriz .NET ReactorThe analyzed MATCHBOIL versions show a change in code obfuscation from originally using Unicode symbol renaming to now employing the Eziriz .NET Reactor obfuscator.Microsoft WindowsThe persistence mechanism can be set up via scheduled tasks or by adding a value to the Windows registry.
Tools
BitLaunchUAC‑0099 uses virtual private servers such as BitLaunch to host its C&C servers, and cloud services such as Cloudflare to hide the servers.CloudflareUAC‑0099 uses virtual private servers such as BitLaunch to host its C&C servers, and cloud services such as Cloudflare to hide the servers.Let’s EncryptWe have also seen that the TLS certificates were generated with Let’s Encrypt, and that the certificates are not reused on other domains.
Countries
Industries
EnergyLater, in June 2026, ESET telemetry registered further MATCHBOIL samples, this time at a company in the energy sector.financialUAC‑0099 is a cyberespionage group targeting governmental organizations, financial institutions, and media, all in Ukraine.GovernmentManufacturingIn December of the same year, they were seen at a manufacturing company.MediaUAC‑0099 is a cyberespionage group targeting governmental organizations, financial institutions, and media, all in Ukraine.TransportationFrom July to August 2025, we saw samples of the downloader at multiple transportation companies.